Configure authentication to Artifact Registry for npm

You must authenticate to Artifact Registry when you use a third-party application to connect to a repository.

You don't need to configure authentication for Cloud Build or Google Cloud runtime environments such as Google Kubernetes Engine and Cloud Run, but you should verify that the required permissions are configured.

Node.js supports two methods for authenticating requests to your Artifact Registry repository:

Access tokens: Use access tokens when authentication in your application is managed by a human user.
Password authentication: Use this option when an application doesn't support Application Default Credentials but does support authentication with a username and password.

Before you begin

Install the Google Cloud CLI. After installation, initialize the Google Cloud CLI by running the following command:
```
gcloud init
```
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

Note: If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update.
(Optional) Configure defaults for gcloud CLI commands.
If you are connecting to repositories from Windows, install PowerShell.
Create a service account to act on behalf of your application.
If you are new to npm, read the overview to learn about scoped packages and the configuration file for your authentication settings.

Generate tokens for authentication

To authenticate your package in Artifact Registry, you must first generate an authentication token. You can then use this token when you make requests from your package to Artifact Registry.

You can generate an oauth2 access token using Google Cloud or an oauth2l token outside of Google Cloud.

Access tokens are valid for 60 minutes. Generate an access token shortly before running commands that interact with repositories. If your access token has expired, you must generate a new access token.

Generate a token using gcloud

To generate an oauth2 access token using Google Cloud, run the following command:

export ACCESS_TOKEN="oauth2accesstoken:$(gcloud auth print-access-token)"

You can now reference ACCESS_TOKEN when you make requests from your Node.js package to Artifact Registry.

Generate a token without using gcloud

To generate an access token using only the oauth2l CLI, do the following:

Install the latest version of oauth2l by running the following command:
```
go install github.com/google/oauth2l@latest
```
Run the following command:
```
export ACCESS_TOKEN="oauth2l fetch --scope cloud-platform"
```
Google Cloud generates an SHA256 hash token and stores it in the ACCESS_TOKEN variable. You can now reference ACCESS_TOKEN when you make requests from your Node.js package to Artifact Registry.

Configure password authentication with service account keys

Use this approach when your Node.js application requires authentication with a specified username and password.

Service account keys are long-lived credentials. Use the following guidelines to limit access to your repositories:

Consider using a dedicated service account for interacting with repositories.
Grant the minimum Artifact Registry role required by the service account. For example, assign Artifact Registry Reader to a service account that only downloads artifacts.
If groups in your organization require different levels of access to specific repositories, grant access at the repository level rather than the project level.
Follow best practices for managing credentials.

To create a service account and configure authentication:

Create a service account to act on behalf of your application, or choose an existing service account that you use for automation.

You will need the location of the service account key file to set up authentication with Artifact Registry. For existing accounts, you can view keys and create new keys on the Service Accounts page.

Go to the Service Accounts page

Note: Service account keys are a security risk if not managed correctly. You should choose a more secure alternative to service account keys whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by Best practices for managing service account keys. If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see Managing secure-by-default organization resources.
If you acquired the service account key from an external source, you must validate it before use. For more information, see Security requirements for externally sourced credentials.
Grant the specific Artifact Registry role to the service account to provide repository access.
If you want to activate the service account in the current gcloud CLI session, run the command:
```
gcloud auth activate-service-account ACCOUNT --key-file=KEY-FILE
```
Where
- ACCOUNT is the user or service account.
- KEY-FILE is path to the service account JSON key file.
Run the following command to print the repository configuration:
```
gcloud artifacts print-settings npm [--project=PROJECT] \
[--repository=REPOSITORY] [--location=LOCATION] --scope=@SCOPE-NAME --json-key=KEY-FILE
```
Where
- PROJECT is the project ID. If this flag is omitted, the current or default project is used.
- REPOSITORY is the ID of the repository. If you configured a default Artifact Registry repository, it is used when this flag is omitted from the command.
- LOCATION is the regional or multi-regional location for the repository.
- SCOPE-NAME is the name of the npm scope to associate with the repository.
  
  Using scopes ensures that you always publish and install packages from the correct repository.
  
  Unscoped packages are associated with your default npm registry, typically the npm public registry. If you don't specify a scope, the returned configuration sets your Artifact Registry repository as the default registry. This can cause problems if your Node.js projects need to install packages from both the public npm registry and your Artifact Registry repository.
- KEY-FILE is path to the service account JSON key file.
Note: The returned configuration settings includes a placeholder email address. An email address is required in the npm configuration to publish npm packages. The placeholder email address is not used by Artifact Registry for authentication.
Add the returned configuration settings to the .npmrc configuration file in your Node.js projects. This file is usually in the same directory as package.json. Make sure that you include these settings in Node.js projects for packages that you publish as well as projects that will install dependencies from your npm repository.
If you have other Node.js repositories to connect to, repeat the previous steps to obtain the settings and add them to the .npmrc file.